3

When I look into my access logs: I find a lot of suspicious activity that looks like attempts to gain administrative access to my system using vulnerabilities from known web software products such as WordPress, Joomla, PhpBB, etc... I have none of these software installed, and are only running my own, un-released (closed source) software.

However, I am running (and using) PhpMyAdmin. I do detect several intrution attempts to this as well, but they look to be unsuccessful: As there are only a few request made per attempt, responded with a 404 or a 401 error.

Here is a list of randomly picked suspicious entries in my access log (Stripped out IP-addresses):

0.0.0.0 - - [09/Mar/2016:17:10:30 +0100] "GET /CFIDE/administrator/ HTTP/1.1" 404 1057 "-" "-"
0.0.0.0 - - [09/Mar/2016:14:54:02 +0100] "GET http://zc.qq.com/cgi-bin/common/attr?id=260714&r=0.6554975758995777 HTTP/1.1" 404 1053 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; 360SE)"
0.0.0.0 - - [07/Mar/2016:23:29:52 +0100] "GET /muieblackcat HTTP/1.1" 404 1057 "-" "-"
0.0.0.0 - - [07/Mar/2016:23:29:52 +0100] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1057 "-" "-"
0.0.0.0 - - [07/Mar/2016:23:29:53 +0100] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 404 1057 "-" "-"
0.0.0.0 - - [07/Mar/2016:23:29:54 +0100] "GET //pma/scripts/setup.php HTTP/1.1" 404 1057 "-" "-"
0.0.0.0 - - [07/Mar/2016:23:29:54 +0100] "GET //myadmin/scripts/setup.php HTTP/1.1" 404 1057 "-" "-"
0.0.0.0 - - [07/Mar/2016:23:29:55 +0100] "GET //MyAdmin/scripts/setup.php HTTP/1.1" 404 1057 "-" "-"
0.0.0.0 - - [07/Mar/2016:21:42:52 +0100] "GET /wordpress/ HTTP/1.1" 404 1060 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2563.97 Safari/527.26"
0.0.0.0 - - [07/Mar/2016:15:02:32 +0100] "GET //admin/scripts/setup.php HTTP/1.1" 401 1310 "-" "-"
0.0.0.0 - - [07/Mar/2016:15:02:32 +0100] "GET //admin/pma/scripts/setup.php HTTP/1.1" 401 1314 "-" "-"
0.0.0.0 - - [07/Mar/2016:15:02:33 +0100] "GET //admin/phpmyadmin/scripts/setup.php HTTP/1.1" 401 1321 "-" "-"
0.0.0.0 - - [29/Feb/2016:10:02:03 +0100] "GET /administrator/ HTTP/1.1" 406 - "http://mydomain.com/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36"
0.0.0.0 - - [29/Feb/2016:00:09:34 +0100] "GET http://24x7-allrequestsallowed.com/?PHPSESSID=aab45f4f00143PRZJW%5EHYCMFUAZ HTTP/1.1" 200 178 "-" "-"
0.0.0.0 - - [28/Feb/2016:20:10:11 +0100] "GET /wp-login.php HTTP/1.1" 406 - "http://mydomain.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36"

Should I be worried about my customers privacy and security? If so: Should I file a police report?

5

Looks like normal scanning background noise to me. All of the services targeted were historically known to have security vulnerabilities, resulting in server compromise. Most of these issues have been fixed in later versions, but attackers still regularly scan for them on the off-chance that they can hijack more servers for dubious purposes.

If they all gave 40x errors, they've not got through, so there shouldn't be any direct worry about your customer data. There might be ways into your server, but they would usually have received a 20x response - things like SQL injection often just return unexpected data, using an expected method (such as a web page).

I would doubt that the police would have any interest in this - chances are that the scanning IP belongs to a third party whose server was running one of those vulnerable applications, so the chances of linking back to the actual attacker are slim.

If you're worried about this kind of scanning, consider manually blocked IP addresses that are performing it - but be aware that you may end up blocking legitimate users as a side effect.

0

IMO it's worth to check the log files for that. It gives you a good overview what kind of websites or software is currently under attack.

If you have a Linux server and if you want prevent that kind of access you can use a tool like fail2ban to automatically block related ip addresses.

A look in my webserver logs shows me every day, that I will never install for example phpMyAdmin on a public webserver.

  • The OP asks whether they should be worried, not asking what they should or shouldn't do in response. – Neil Smithline Mar 11 '16 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.